Struct ServeConfig 

pub struct ServeConfig {

    pub addr: Option<SocketAddr>,
    pub data_dir: Option<PathBuf>,
    pub blobs: Option<BlobBackend>,
    pub s3_bucket: Option<String>,
    pub s3_endpoint: Option<String>,
    pub s3_region: Option<String>,
    pub s3_path_style: bool,
    pub gcs_bucket: Option<String>,
    pub gcs_endpoint: Option<String>,
    pub gcs_anonymous: bool,
    pub azure_account: Option<String>,
    pub azure_container: Option<String>,
    pub azure_access_key: Option<String>,
    pub azure_emulator: bool,
    pub blob_fallback: Option<BlobFallbackConfig>,
    pub auth_root_private_key: Option<String>,
    pub auth_root_public_key: Option<String>,
    pub bootstrap_secret: Option<String>,
    pub signer: Option<AuthSignerConfig>,
    pub max_upload_bytes: Option<u64>,
    pub upload_idle_timeout_secs: Option<u64>,
    pub max_concurrent_uploads: Option<usize>,
    pub http_redirect_addr: Option<SocketAddr>,
    pub default_site: Option<String>,
    pub pop_origin: Option<String>,
    pub protect_previews: bool,
    pub cluster_rate_limit: bool,
    pub shared_cache_coherence: bool,
    pub blob_notify_tier: Option<ProvisionTier>,
    pub blob_notify_account_id: Option<String>,
    pub console: Option<ConsoleConfig>,
    pub s3_ingress_addr: Option<SocketAddr>,
    pub s3_ingress_secret_file: Option<PathBuf>,
    pub s3_ingress_public_url: Option<String>,
    pub s3_ingress_mint_max_ttl_secs: Option<u64>,
    pub s3_ingress_mint_max_bytes: Option<u64>,
    pub s3_ingress_cloud: Option<S3IngressCloud>,
    pub s3_credential: Option<S3CredentialConfig>,
}

serve section — server defaults, overridden by flags/env.

Fields

addr: Option<SocketAddr>

Bind address (e.g. 0.0.0.0:8080).

data_dir: Option<PathBuf>

Data directory for filesystem backends.

blobs: Option<BlobBackend>

Blob object-store backend (fs/s3/gcs/azure) — the config-level analog of the --blobs flag. Absent ⇒ the flag/env decides (--blobs/BOATRAMP_BLOBS, default fs). The flag/env still wins over this (uniform serve precedence). Read primarily by boatramp blob migrate, which builds a source/destination backend from a config file alone; serve also honours it as the config-level fallback under the flag.

s3_bucket: Option<String>

S3 bucket (--blobs s3). Config-level fallback for --s3-bucket/BOATRAMP_S3_BUCKET.

s3_endpoint: Option<String>

S3 endpoint URL (e.g. a MinIO/R2/Tigris endpoint). Fallback for --s3-endpoint.

s3_region: Option<String>

S3 region. Fallback for --s3-region.

s3_path_style: bool

Use S3 path-style addressing (required by MinIO). Fallback for --s3-path-style.

gcs_bucket: Option<String>

GCS bucket (--blobs gcs). Fallback for --gcs-bucket.

gcs_endpoint: Option<String>

GCS storage endpoint URL (e.g. a fake-gcs-server emulator). Fallback for --gcs-endpoint.

gcs_anonymous: bool

Skip GCS credential resolution (anonymous — the emulator). Fallback for --gcs-anonymous.

azure_account: Option<String>

Azure storage account name (--blobs azure). Fallback for --azure-account.

azure_container: Option<String>

Azure container name (--blobs azure). Fallback for --azure-container.

azure_access_key: Option<String>

Azure storage account access key (shared-key auth). Fallback for --azure-access-key. Prefer the env/flag over persisting a key in the config file.

azure_emulator: bool

Use the Azurite emulator (well-known dev credentials + local endpoint). Fallback for --azure-emulator.

blob_fallback: Option<BlobFallbackConfig>

[serve.blob_fallback] — a read-only SECONDARY blob backend for a zero-downtime backend switch (blob-backend migration Part 2). When set, serving reads the PRIMARY (the blobs/s3_*/gcs_*/azure_* fields above) first and, on a definitive miss for a boatramp-owned key, falls through to this secondary — so a --blobs switch (fs→cloud, provider→provider, region→region) has no serving gap while boatramp blob migrate drains the secondary into the primary. Writes are primary-only; the secondary is never written or deleted. This is a bounded transition aid: drain, verify, then remove this block and restart (the node logs a prominent startup WARNING while it is active, and GC prune is refused). Absent ⇒ no fallback (unchanged). See BlobFallbackConfig.

auth_root_private_key: Option<String>

Token root private key (hex) — issuing node: verifies and mints tokens / OIDC exchanges.

auth_root_public_key: Option<String>

Token root public key (hex) — verify-only node.

bootstrap_secret: Option<String>

Single-use bootstrap secret enabling POST /api/tokens/bootstrap (mint the first token without an admin bearer). Prefer the BOATRAMP_BOOTSTRAP_SECRET env / --bootstrap-secret flag so it isn’t persisted in the config file.

signer: Option<AuthSignerConfig>

External token signer ([serve.signer]): mint with a KMS/HSM/Vault-held root key instead of an in-process auth_root_private_key. Absent ⇒ the in-process key. When set, its public half is the trust anchor.

max_upload_bytes: Option<u64>

Reject blob uploads larger than this many bytes.

upload_idle_timeout_secs: Option<u64>

Abort an upload that stalls for longer than this many seconds.

max_concurrent_uploads: Option<usize>

Cap on simultaneous blob uploads.

http_redirect_addr: Option<SocketAddr>

In a TLS mode, bind this plain-HTTP address on a second listener that redirects to HTTPS (dual-listener). Only read in tls builds.

default_site: Option<String>

Site to serve for a Host matching no domain, instead of 404.

pop_origin: Option<String>

The fleet’s canonical public origin (e.g. https://cp.example.com) that a per-request proof-of-possession must bind to (aud). Required for holder-bound (cnf/PoP) tokens to be usable — a proof’s origin is compared against this value, never against a Host/X-Forwarded-* header.

protect_previews: bool

Require a valid control-plane token to view deployment previews.

cluster_rate_limit: bool

Rate-limit cluster-wide via the control-plane KV instead of per node.

shared_cache_coherence: bool

Keep the config cache coherent across processes sharing one KV via the changelog.

blob_notify_tier: Option<ProvisionTier>

Cloud blob-change notification provisioning tier (FA-5b2): how boatramp obtains the native event pipeline (S3→SQS) that backs a blob trigger — dry-run (print the recipe), provision (create + retract), verify-only (operator pre-wired), or refuse (fail closed). Absent ⇒ no provisioning: blob triggers then work only on a self-watching backend (fs). Only wired for the S3 backend (--features s3).

blob_notify_account_id: Option<String>

The AWS account id used to scope the provisioned SQS queue’s SendMessage policy (aws:SourceAccount). Required when blob_notify_tier provisions.

console: Option<ConsoleConfig>

[serve.console] — the embedded web management console. Absent (or enabled: false) ⇒ not served. This is the baseline for the dynamic console.* daemon-config override, which can enable/move it at runtime (boatramp config set console.enabled true) without a restart.

s3_ingress_addr: Option<SocketAddr>

Bind address for the dedicated local S3-ingress listener (PLAN-blob-s3-ingress, Architect HIGH-4). Absent ⇒ the local S3 face is NOT served (it is opt-in — a deployment that only mints cloud-brokered credentials never needs it). This is a SEPARATE listener from the control-plane addr: it has its own SigV4 auth surface and never reaches serve_by_host or the /api router.

s3_ingress_secret_file: Option<PathBuf>

Path to the dedicated S3-ingress root secret file (raw 32 bytes) — the independently- rotatable HKDF root for secret_access_key derivation (hard domain separation from the [secrets] KEK + the COSE signing key). Like [secrets].kek_file, this holds a path, never key material in the config text, and (in a cluster) the same file must be present on every node so every node derives the same secret_access_key. Absent on a single node ⇒ an ephemeral per-process root is auto-generated; absent on a multi-node deployment ⇒ the S3 face is refused to enable (fail-closed — credentials would otherwise be un-verifiable across nodes). Prefer the BOATRAMP_S3_INGRESS_SECRET_FILE env / flag so the path stays out of the committed config where that matters operationally.

s3_ingress_public_url: Option<String>

The publicly-reachable base URL an external client targets for the local S3 face — what a minted upload credential (boatramp:handlers/blob-upload guest mint / boatramp blob mint-upload operator) embeds as its endpoint (a presigned-put URL prefix, or the SDK endpoint for temp-credentials). Absent ⇒ derived from s3_ingress_addr as http://<addr> (fine for a same-host dev/test loop; set it explicitly to the TLS-terminated public URL in production). Only consulted when guest/operator upload minting is wired (blob-upload feature + the face enabled).

s3_ingress_mint_max_ttl_secs: Option<u64>

Operator ceiling (seconds) on a minted upload credential’s TTL — a guest/operator can only request a SHORTER lifetime (the mint clamps to this). Absent ⇒ a conservative default (DEFAULT_S3_INGRESS_MINT_MAX_TTL_SECS). A 0 disables minting entirely (the binding is never attached).

s3_ingress_mint_max_bytes: Option<u64>

Operator ceiling (bytes) on a minted credential’s max_bytes constraint — a guest can only request a SMALLER cap (clamped to this). Absent ⇒ no host-side max-bytes clamp (the per-container ceiling at the face still applies).

s3_ingress_cloud: Option<S3IngressCloud>

Cloud brokering (M4): when the node’s blob backend is a cloud object store (S3/GCS/Azure) and this is set, minting brokers a NATIVE scoped credential (STS session policy / signed URL + CAB / user-delegation SAS) so the client uploads DIRECTLY to the real store (bytes never transit the node) — INSTEAD of the local S3 face. Absent ⇒ the local face is used (an fs/in-memory backend, or a cloud backend that re-transits through the local face). See S3IngressCloud.

s3_credential: Option<S3CredentialConfig>

Node-level base S3 credential source ([serve.s3_credential], task #505). When set, BOTH the S3 blob object backend (--blobs s3) and the AWS blob-upload cloud minter ([serve.s3_ingress_cloud]) source their base AWS credential from boatramp’s [secrets] sealed store instead of the ambient AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env chain. ONE shared source (both consumers read the SAME bucket key). Absent ⇒ the ambient AWS env chain (current behavior, non-breaking). Requires a [secrets] envelope when the secret_access_key is a sealed boatramp:/env: ref — a configured ref with no envelope is a startup error (fail-closed, no silent env fallback). See S3CredentialConfig.

Trait Implementations

impl Clone for ServeConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ServeConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ServeConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ServeConfig

where ServeConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.